1. THE IMPORTANCE OF USER ACCESS CONTROL
And Why I Recommend RBAC (ROLE BASED ACCESS CONTROL)

2. USER ACCESS CONTROL IS CRITICAL
SARBANES OXLEY (SOX)
law passed in to protect investors from fraud, applies to ALL publicly held
companies; some sections apply to privately held companies.
Failure of privately owned companies to follow Sarbanes Oxley guidelines can derail future plans for taking company public and/or selling business to a privately owned company.
A Key Principle of SARBANES OXLEY is User Access Control

3. WHAT IS USER ACCESS CONTROL?
A way to ensure segregation of duties
It takes more than one person to complete a task
Internal controls to help prevent error
Makes it harder for individuals to commit fraud

4. Access Control As It Relates To User Identity
Minimum Access – users should have access to ONLY the data that they need to perform their job
Users need full access to data that they need to be able to manipulate (create, modify, save)
Provide Read-only access to data created by other people users need in order to do their job.

5. Individual Access vs Role Based Access
Possible to setup individual access for each user especially in smaller companies
More desirable to create user roles based on job description
As you add new employees, simply assign them appropriate role rather than create individualized access
When employees change departments simply change role to which they are assigned

6. Advantages & Disadvantages of RBAC
Advantage: Easy Scalabilty
Advantage: Less Administration Required; Saves time
Disadvantage: Less flexibility; can’t override access permissions
Disadvantage: Can be a nightmare if organization is not well structured

7. RBAC is Best User Access Control System
RBAC is the best way to manage user access if your organization has a clear structure, clear job descriptions, and a management team willing to enforce the roles.
Not using Role Based Access Controls can make it harder to grow the company, and to sell the company in the future. A good Role Based Access Control can save time and money. It can also help protect the company from fraud.